[SOLVED] failed to install override security policy error in UEFI boot

Deadvi · 2013-09-05 18:10:06

SOLUTION: Mount the USB flash drive's ESP and copy EFI/BOOT/loader.efi to EFI/BOOT/bootx64.efi, overwriting the original file.

Hi everyone.

So I'm trying to dual-boot Arch and W8 in UEFI.
When I'm trying to boot Arch via USB in UEFI I get the following error "failed to install override security policy".
My computer is compatible with UEFI as I already have Windows in UEFI and in the past I was able to boot Arch in UEFI.

Can I have some help here?

Thanks in advance,

Deadvi

edit: added the solution to the problem

Last edited by Deadvi (2013-09-07 12:39:59)

alphaniner · 2013-09-05 18:42:13

Can I have some help here?

Can we have some more information? Have you tried with Secure Boot disabled? You say "in the past I was able...". Was that with the same h/w? Have you {since|ever} updated mobo f/w? Did you google the error and read the first result?

Deadvi · 2013-09-05 18:56:59

Have you tried with Secure Boot disabled?

I assume that Legacy USB Support is the same as Secure Boot. In that case, yes. I've tried with both on and off. With Legacy off I can't see the USB in the boot list.

You say "in the past I was able...". Was that with the same h/w? Have you {since|ever} updated mobo f/w?

Exact same h/w. I've updated my mobo before and I was able to boot into UEFI

Did you google the error and read the first result?

Yes I did and I think it doesn't have anything to do with my problem.

My computer is a Asus G73Jw. Any other information you required feel free to ask that I would gladly give it.

EDIT:

I'm creating the USB pen by formatting it to FAT32, mount the ISO and copy the content over to the pen.
Maybe I'm preparing the USB wrong.
What's the best way to create a bootable UEFI USB stick in Windows?

Last edited by Deadvi (2013-09-05 19:31:57)

alphaniner · 2013-09-05 19:28:33

Legacy USB Support and Secure Boot are completely unrelated.

Moreover I can't understand how you could conclude the link has nothing to do with your problem. The developer of ReFInd (a Linux UEFI bootloader) responded "The only reference I can find to that error message is in the source code to PreLoader.efi, the Linux Foundation's Secure Boot loader." It's reasonable to conclude he knows more about this subject than you or I, so looking into his suggestions seems sensible...

KairiTech · 2013-09-05 19:42:03

I have the exact same issue with an ASUS M5A99X EVO Rev. 1.0 flashed with the latest BIOS Version 1708.

This mobo is NOT "Windows 8 ready" so there's no secure boot option to disable.

Deadvi · 2013-09-05 19:50:27

This mobo is NOT "Windows 8 ready" so there's no secure boot option to disable.

That means there's no way to have a dual-boot UEFI Windows 8 and Arch Linux on my laptop? Bloody hell.

EDIT:

This doesn't mean that I can't install Arch in UEFI right? Without dual-boot, just Arch.

Last edited by Deadvi (2013-09-05 19:55:50)

KairiTech · 2013-09-05 19:56:19

Deadvi wrote:

This mobo is NOT "Windows 8 ready" so there's no secure boot option to disable.
That means there's no way to have a dual-boot UEFI Windows 8 and Arch Linux on my laptop? Bloody hell.

I don't want to have anything to do with W8 so I'm in a worse off position than you.

Deadvi · 2013-09-05 20:03:02

I just wanted W8 for some games that aren't yet available in Linux. It's kinda silly to have a gaming laptop where I can't play what I want.

My main OS is going to be Arch, whether is UEFI or not.

I don't know if you notice my edit in my post above but it's possible to install just Arch in UEFI? The Secure Boot option only locks for dual-boot right? Or am I completely wrong?

srs5694 · 2013-09-05 22:04:58

Deadvi wrote:

So I'm trying to dual-boot Arch and W8 in UEFI.
When I'm trying to boot Arch via USB in UEFI I get the following error "failed to install override security policy".
My computer is compatible with UEFI as I already have Windows in UEFI and in the past I was able to boot Arch in UEFI.

If the only problem is that message, ignore it. If something else is going wrong, please elaborate -- for instance, do you not then see a boot loader? Or you do see a boot loader, and can select an OS to boot, but the boot hangs? (If so, with what screen output?)

Deadvi wrote:

My computer is a Asus G73Jw.

According to the ASUS Web site, that computer shipped with Windows 7. Thus, it might not support Secure Boot, and it almost certainly did not ship with Secure Boot enabled. Thus, you can safely bypass the PreLoader program: Mount the USB flash drive's ESP and copy EFI/BOOT/loader.efi to EFI/BOOT/bootx64.efi, overwriting the original file.

There are also three firmware versions (the original plus two updates) available for download. It's conceivable that an upgrade will improve matters, if you've actually got a problem rather than just a message that flashes for a moment and then disappears.

Deadvi wrote:

This mobo is NOT "Windows 8 ready" so there's no secure boot option to disable.
That means there's no way to have a dual-boot UEFI Windows 8 and Arch Linux on my laptop? Bloody hell.

No, that's not what it means. Windows 8 does not require Secure Boot to work. Microsoft does require that computers that ship with Windows 8 and that have Windows 8 certification ship with Secure Boot enabled. This requirement does not limit Windows 8 to installing or running only on computers that support Secure Boot.

Deadvi wrote:

I don't know if you notice my edit in my post above but it's possible to install just Arch in UEFI? The Secure Boot option only locks for dual-boot right? Or am I completely wrong?

I can't speak to your laptop specifically (there may be laptop-specific issues), but as a general rule, a single-boot configuration with Linux in EFI mode is quite possible. So is a dual-boot without Secure Boot. So is a dual-boot with Secure Boot. So is a single-boot with Secure Boot, for that matter. Secure Boot and dual-boot configurations both increase the complexity involved, but they are both certainly possible.

Deadvi · 2013-09-06 11:38:51

If the only problem is that message, ignore it. If something else is going wrong, please elaborate -- for instance, do you not then see a boot loader? Or you do see a boot loader, and can select an OS to boot, but the boot hangs? (If so, with what screen output?)

It appears a blue box with the message "failed to install override security policy: 14 (not found)" and an OK button. I press the button and appears the message "Reboot and select a proper boot device or insert boot media in selected boot device and press any key".

Mount the USB flash drive's ESP and copy EFI/BOOT/loader.efi to EFI/BOOT/bootx64.efi, overwriting the original file.

I did this and now I can see a bootloader. It appears an option to boot Arch in UEFI and two options for UEFI shells. I select the option to boot Arch and Arch starts to boot.

However, during the boot, after the message to wait 30 seconds for the device, I get the error

 ERROR: '' device did not show up after 30 seconds...'
Falling back to interactive prompt
You can try to fix the problem manually, log out when you are finished
sh: can't access tty; job control turned off

and a prompt with [rootfs /]#

Last edited by Deadvi (2013-09-06 11:39:39)

srs5694 · 2013-09-06 15:24:42

First, I recommend you contact James Bottomley with a bug report about PreLoader.efi. (His e-mail is James.Bottomley at HansenPartnership.com; this is in the source code to PreLoader, so it's OK to post it here.) You might also want to file an Arch Linux bug report. Clearly, this should not be happening, and on most computers it doesn't. It seems that Secure Boot is disabled on your system, and on such a computer, PreLoader should just pass control on to loader.efi, rather than fail.

Your new problem ("device did not show up after 30 seconds....") sounds like one of two issues, neither of which is related to the first:

The boot manager may not have passed a proper "root=" option to the kernel. This would be a configuration problem with the boot loader as delivered on the Arch installation disc. On the face of it, this seems like a rather unlikely problem, since it would have caused problems for everybody else trying to install in EFI mode, too, and the forum hasn't been flooded with reports of such difficulties.
There may be a driver issue. If you're using a particularly new model, it could be that the kernel just doesn't yet include a suitable driver for your disk controller. Since the computer shipped with Windows 7, though, it's probably at least a year old, so this also doesn't seem like a very probable explanation, unless perhaps whoever prepared the kernel slipped up and left out an important driver. One thing you could try is fiddling with the disk controller mode in the firmware -- setting the AHCI option on or off. Changing that mode could cause problems with Windows, though, so be cautious in doing this.

You might be able to learn more by typing "ls /dev/sd*" at the prompt you get. This will show you what disk devices have been detected. If you see all your disks (probably at least /dev/sda, /dev/sdb, and partitions on each of them, for your hard disk and USB flash drive), then you can rule out a driver issue and begin investigating possible configuration problems.

Deadvi · 2013-09-06 22:02:25

You might be able to learn more by typing "ls /dev/sd*" at the prompt you get. This will show you what disk devices have been detected. If you see all your disks (probably at least /dev/sda, /dev/sdb, and partitions on each of them, for your hard disk and USB flash drive), then you can rule out a driver issue and begin investigating possible configuration problems.

I can confirm that I can see all my disks and my USB flash drive. So it has to be some configuration problem.

I was fiddling with Arch this afternoon and I notice this line on the boot stage

 losetup: /run/archiso/bootmnt/arch/x86_64/root-image.fs.sfs: failed to setup loop device: No such file or directory

Could this be the source of the problem?

cfr · 2013-09-06 23:36:06

Deadvi wrote:

I'm creating the USB pen by formatting it to FAT32, mount the ISO and copy the content over to the pen.
Maybe I'm preparing the USB wrong.
What's the best way to create a bootable UEFI USB stick in Windows?

You need https://wiki.archlinux.org/index.php/UE … B_from_ISO.

srs5694 · 2013-09-06 23:49:59

Deadvi wrote:

 losetup: /run/archiso/bootmnt/arch/x86_64/root-image.fs.sfs: failed to setup loop device: No such file or directory

Could this be the source of the problem?

Probably.

cfr wrote:

You need https://wiki.archlinux.org/index.php/UE … B_from_ISO.

I concur. Bootable media are very delicate, and if you don't prepare them in exactly the right way, you can get all sorts of problems. Tools like unetbootin are designed to simplify this task, but as the details vary from one distribution to another, and even from one version of one distribution to another, problems inevitably occur when you use such tools. Copying files over manually is unlikely to work unless you're following official instructions precisely.

Deadvi · 2013-09-07 00:13:18

You need https://wiki.archlinux.org/index.php/UE … B_from_ISO.

I kinda follow the instructions from that link. I don't have at the moment a Linux installation so I just did that on Windows. Mounted the USB drive, mounted the ISO, copy the files over. I'll download a Live CD and try on Linux.

What if I install Arch in UEFI first and Windows later? Would that be too much of a problem?

cfr · 2013-09-07 00:17:25

It is generally easier to install Windows first as it will mess up any boot loader/manager you install and configure for Arch.

KairiTech · 2013-09-07 01:42:47

Thus, you can safely bypass the PreLoader program: Mount the USB flash drive's ESP and copy EFI/BOOT/loader.efi to EFI/BOOT/bootx64.efi, overwriting the original file.

Works perfectly on my ASUS M599X EVO Rev. 1 flashed to the latest BIOS, Version 1708. Boot menu appears and I am able to complete my Arch install.

Deadvi · 2013-09-07 12:36:45

I figure out what the problem was. If I create the USB drive on Windows, all the files names and folders were uppercase. And this file "root-image.fs.sfs" were ROOT_IMAGE_FS.sfs. That way it couldn't be found.
My solution was to create the USB drive on Linux, following this instructions. Now all the files and folders are lowercase and the file is with the correct name.

I want to thank everyone who took the time to read and helped me. I can finally boot Arch in UEFI.

I'll mark this thread as Solved and will add the the fix to the original error on my first post.

Last edited by Deadvi (2013-09-07 12:38:18)

Xtof · 2014-03-23 14:41:26

Is anybody could detail how to modify the USB flash drive's ESP under linux ?

After several days of a desperate quest to boot the archiso in UEFI mode with my system, I was able to modify the EFI partition by using the following steps :
- download the archlinux-2014.03.01-dual.iso ISO file
- Edit this file using ultraISO... under windows 7 (That is really bad, I know ). I copied efi/boot/loader.efi to efi/boot/bootx64.efi as indicated in the first post
- copy de modified Archiso to the USB key using the usual dd command

My system is a mini-ITX mainboard from MSI (E350IA-E45) with an AMD Fusion E350. The BIOS has a very basic UEFI implementation wich doesn't support secure-boot. The original ArchISO was causing this "failed to install override security policy UEFI" error. This mainboard was initially upgraded to the beta 1.6B11 BIOS version found here.

As an additionnal information, I has not been able to successfully follow the instructions given in this Wiki page on USB Flash nanual installation in UEFI mode has it appeared highly unclear and too approximate for me.

Last edited by Xtof (2014-03-23 14:46:44)

Arch Linux

#1 2013-09-05 18:10:06

[SOLVED] failed to install override security policy error in UEFI boot

#2 2013-09-05 18:42:13

Re: [SOLVED] failed to install override security policy error in UEFI boot

#3 2013-09-05 18:56:59

Re: [SOLVED] failed to install override security policy error in UEFI boot

#4 2013-09-05 19:28:33

Re: [SOLVED] failed to install override security policy error in UEFI boot

#5 2013-09-05 19:42:03

Re: [SOLVED] failed to install override security policy error in UEFI boot

#6 2013-09-05 19:50:27

Re: [SOLVED] failed to install override security policy error in UEFI boot

#7 2013-09-05 19:56:19

Re: [SOLVED] failed to install override security policy error in UEFI boot

#8 2013-09-05 20:03:02

Re: [SOLVED] failed to install override security policy error in UEFI boot

#9 2013-09-05 22:04:58

Re: [SOLVED] failed to install override security policy error in UEFI boot

#10 2013-09-06 11:38:51

Re: [SOLVED] failed to install override security policy error in UEFI boot

#11 2013-09-06 15:24:42

Re: [SOLVED] failed to install override security policy error in UEFI boot

#12 2013-09-06 22:02:25

Re: [SOLVED] failed to install override security policy error in UEFI boot

#13 2013-09-06 23:36:06

Re: [SOLVED] failed to install override security policy error in UEFI boot

#14 2013-09-06 23:49:59

Re: [SOLVED] failed to install override security policy error in UEFI boot

#15 2013-09-07 00:13:18

Re: [SOLVED] failed to install override security policy error in UEFI boot

#16 2013-09-07 00:17:25

Re: [SOLVED] failed to install override security policy error in UEFI boot

#17 2013-09-07 01:42:47

Re: [SOLVED] failed to install override security policy error in UEFI boot

#18 2013-09-07 12:36:45

Re: [SOLVED] failed to install override security policy error in UEFI boot

#19 2014-03-23 14:41:26

Re: [SOLVED] failed to install override security policy error in UEFI boot

Board footer